Abstract: A system and method for pairing a mobile device with a computer for password-less login using a network service is provided. The method may include sending a pairing request to a network server from a computing device, wherein the pairing request includes computer authentication data and a computer public key. The network server may pair the mobile device with the computing device; wherein, the computing device may generate a pairing secret key and an associated QR image, which the user is prompted to scan using the mobile device. A pairing agent within the mobile device may validate the computer authentication data and parse the computer public key therefrom. In some embodiments a PIN could be displayed by the computer and entered by the user into the mobile device or silently exchanged between the computer and the mobile device, when proximate to each other, for the mutual authentication data validation.

Abstract: A system and method for pairing a mobile device with a computer for password-less login using a network service is provided. The method may include sending a pairing request to a network server from a computing device, wherein the pairing request includes computer authentication data and a computer public key. The network server may pair the mobile device with the computing device; wherein, the computing device may generate a pairing secret key and an associated QR image, which the user is prompted to scan using the mobile device. A pairing agent within the mobile device may validate the computer authentication data and parse the computer public key therefrom. In some embodiments a PIN could be displayed by the computer and entered by the user into the mobile device or silently exchanged between the computer and the mobile device, when proximate to each other, for the mutual authentication data validation.

Abstract: The disclosed computer-implemented method for blocking push authentication spam may include (1) detecting an attempt by an unauthenticated source to gain access to a web resource protected by an MFA service, (2) issuing, to a mobile device of an authenticated user of the MFA service, a push authentication request to query the authenticated user about whether to allow the unauthenticated source's attempt, (3) determining, based at least in part on the push authentication request issued to the mobile device, that the authenticated user has not allowed the unauthenticated source's attempt, and (4) in response to determining that the authenticated user has not allowed the unauthenticated source's attempt, blacklisting the unauthenticated source such that the MFA service refuses to issue any subsequent push authentication requests in connection with the unauthenticated source. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A system for authenticating a user to a relying party. A user sends an access request to a relying party web application. In response, the application sends a page with JavaScript that detects a plug-in at the user and detects the relying party domain. The plug-in uses its device certificate or other pre-established credentials to sign a challenge along with other site and user information including the site domain, the authentication service URL and user identifier, and send it, along with the data including the domain and the user identifier, to an authentication service. The service authenticates the information and sends back to the plug-in a short ticket that can be passed on to the relying party, which can validate it using the Radius protocol and an authentication service call, thereby authenticating the user.